The moment you realize an employee has been stealing from your company, the instinct is panic. But what happens in the next 48 hours can determine whether you recover your losses or lose your chance to do so entirely.
Employee embezzlement is more common than most business owners want to believe. According to the ACFE’s Occupational Fraud 2024: A Report to the Nations, the typical fraud scheme runs for 14 to 18 months before detection, with a median loss of $145,000 per case. Perhaps more alarming: organizations that lack rapid response protocols recover, on average, only about 10% of stolen assets compared to roughly 25% for those with proactive monitoring and immediate action plans in place.
The first 48 hours are not about confrontation or punishment. They’re about protecting evidence, limiting further damage, and positioning your company for maximum legal and financial recovery. Here’s exactly what to do step by step.
Step 1: Don’t Confront the Employee Yet
This is the single most critical rule in the first 48 hours of discovering employee embezzlement, and it is consistently the one business owners violate. The impulse to confront to demand an explanation or an immediate confession is completely understandable. But it is almost always the wrong move at this stage.
Premature confrontation can:
- Alert the employee to destroy or alter financial records
- Trigger rapid asset transfers to hide stolen funds
- Expose your company to wrongful termination or defamation liability if evidence is incomplete
- Compromise the integrity of any subsequent criminal or civil case
Instead, restrict the employee’s access to sensitive financial systems, accounts, and data quietly without explanation if possible. Reassign responsibilities that give them access to company funds under a neutral business justification. The goal is to stop ongoing theft without signaling that an investigation has begun.
If you’re uncertain about whether confrontation is appropriate at any point, read our guide on what to do if you suspect employee theft before confronting them it walks through the timing and legal considerations in detail.
Step 2: Immediately Secure and Preserve Evidence
Within the first few hours of discovering employee embezzlement, your priority is evidence preservation. Courts require a clear chain of custody for financial records to be admissible and evidence that is altered, deleted, or contaminated after discovery may be unusable.
What to secure immediately:
- Bank statements, canceled checks, and wire transfer records
- Expense reports, invoices, and vendor payment documentation
- Payroll records and timesheet data
- Email communications and digital messaging logs
- Accounting software data (export and back up before any access changes)
- Physical documents, receipts, or company credit card records
- Surveillance footage if applicable
Make copies of everything. Store originals in a secure location that the employee cannot access. Do not open, annotate, or alter any original documents preserve them exactly as found. Your attorney and forensic accountant will need clean originals to build a legally sound case.
For a detailed breakdown of what investigators look for and how to document evidence properly, see our guides on what fraud investigators actually look for and how to document financial fraud so it holds up in court.
Step 3: Assemble Your Response Team Immediately
Employee embezzlement cases involve overlapping legal, financial, and investigative dimensions. Trying to manage them internally or with only one type of professional is one of the most costly mistakes organizations make.
Your response team should include:
- Outside legal counsel (business litigation or criminal defense attorney) to manage legal exposure and guide the investigation
- A forensic accountant or certified fraud examiner to quantify losses, trace transactions, and build a documented evidence package
- A computer forensics specialist if there is any indication that digital records have been manipulated or deleted
- Your insurance broker or risk manager to review your fidelity bond or crime insurance policy most have strict notice of claim deadlines that begin running from the date of discovery
One regional corporation that discovered a $300,000 employee embezzlement scheme learned this lesson the hard way: after their outside auditor confirmed the loss, the company filed an insurance claim only to receive just $25,000 due to policy coverage limitations they hadn’t reviewed in advance. The window to address those gaps closed the moment the loss occurred.
Understand what forensic accountants do and when you need one, and review how much a fraud investigation costs in 2026 so you can make an informed decision quickly.
Step 4: Assess the Scope of the Embezzlement
Once your response team is in place, the next priority is understanding the full scope of the employee embezzlement. The amount you initially discover is rarely the full picture. Research consistently shows that the average embezzlement scheme involves small, repeated thefts approximately 85% of cases follow this pattern meaning the total loss often exceeds the initial evidence suggests.
Your forensic accountant will systematically examine:
- How long the scheme has been running
- Which accounts, departments, or processes were exploited
- Whether any other employees were involved (collusion increases median losses from $75,000 to over $329,000)
- Whether funds have been transferred externally and can still be traced or frozen
This phase also determines the appropriate legal strategy specifically, whether to pursue criminal charges, civil recovery, or both. Understanding how to prove embezzlement without direct evidence is essential context for this conversation with your attorney.
Step 5: Control Internal Communication and Notify Stakeholders Strategically
Employee embezzlement cases are information sensitive. Word spreading through your organization before the investigation is complete can destroy evidence, create legal liability, and damage employee morale in ways that compound long after the case closes.
In the first 48 hours, limit knowledge of the investigation to the smallest possible group of senior leadership and your response team. Do not discuss the matter with HR, other managers, or department heads until your attorney advises it is appropriate.
When it becomes necessary to notify stakeholders board members, investors, or financial partners do so with legal counsel present and with factual, carefully framed communications that do not make unproven accusations or admit organizational liability.
Also consider:
- Notifying your bank to flag or freeze accounts the employee had access to
- Reviewing outstanding payments to vendors the employee managed
- Checking whether any anonymous tips or whistleblower reports about this employee exist in your internal systems that were not previously acted upon
Step 6: Evaluate Your Legal Options and Recovery Path
By hour 24 to 48, you and your legal team should be assessing your full range of options. These are not mutually exclusive:
- Criminal referral: Reporting to local law enforcement, the FBI (for cases involving wire fraud or federal programs), or the DOJ. Note that only 57% of embezzlement cases are referred to law enforcement, and of those, 72% result in conviction so the path is viable but requires strong evidence.
- Civil lawsuit: You can sue for fraud in civil court even if law enforcement declines to prosecute, and civil cases have a lower burden of proof.
- Asset recovery: Courts can issue emergency injunctive relief including temporary restraining orders to freeze the employee’s assets before they are spent or hidden.
- Insurance claims: File your fidelity or crime policy claim immediately given notification deadlines.
- Negotiated restitution: In some cases, a documented evidence package presented to the employee’s attorney can produce a faster, quieter recovery through a restitution agreement.
For a full breakdown of your financial recovery options, read how to recover money from an embezzling employee.
Conclusion: Speed and Strategy Are Everything
Employee embezzlement is a crisis but it is a manageable one when you act with speed, precision, and the right professional team. The organizations that recover the most are those that avoid the two most common mistakes: confronting the employee prematurely and delaying professional engagement.
Every hour that passes after discovery is an opportunity for evidence to degrade, assets to move, and your legal position to weaken. Conversely, every hour you spend building a documented, professionally managed case is an investment in your ability to recover what was taken and to close the internal control gaps that allowed the theft to happen in the first place.
After the crisis is resolved, revisit how to build an anti fraud policy that actually stops employee theft so your business is never in this position again.
Facing an active embezzlement situation and don’t know where to start? Visit FraudOrder.co to connect with experienced fraud investigators who can help you act fast, protect your evidence, and maximize your recovery.
Frequently Asked Questions
Q1: Should I call the police immediately after discovering employee embezzlement? Not necessarily at least not as your very first call. Before contacting law enforcement, it’s generally advisable to consult an attorney and begin evidence preservation. Local police often lack the resources for complex financial crimes, and a poorly managed initial report can complicate your case. Once you have a well documented evidence package, a referral to law enforcement or the FBI becomes significantly more effective.
Q2: Can I terminate the employee immediately after discovering embezzlement? Termination may be appropriate, but the timing and manner matter enormously. Firing someone before your investigation is properly documented can expose you to wrongful termination claims and may alert them to destroy evidence. Your attorney should guide the timing of termination based on the strength of your current evidence and your jurisdiction’s employment laws. Read our guide on whether you can fire someone for embezzlement without going to the police for a detailed breakdown.
Q3: How do I know how much was actually stolen? Initial observations almost never capture the full scope of employee embezzlement. Forensic accountants systematically reconstruct transaction histories, identify manipulated records, and trace fund flows across accounts and time periods. The final figure is often substantially higher than what is initially apparent, which is why professional forensic analysis is essential before any settlement or legal filing.
Q4: What if the embezzling employee also handled my payroll or taxes? This is a high priority complication that requires immediate attention from both your forensic accountant and a tax professional. Payroll fraud, ghost employees, and falsified tax filings can create secondary regulatory and liability issues for the business itself. Review our post on payroll fraud through fake timesheets and ghost workers for context on common schemes.
Q5: What evidence is most important to preserve in the first 48 hours? Bank statements, wire transfer records, internal accounting software data, email communications, expense documentation, and any physical receipts or invoices the employee managed. Digital evidence is particularly time sensitive accounting software logs and email servers can auto delete data on a rolling schedule. A computer forensics specialist should be brought in early if there’s any concern about digital record tampering.
Q6: Will employee embezzlement show up on a background check for future employment? If the employee is charged or convicted, yes criminal records are generally discoverable in background checks. However, if the matter is handled through civil recovery or internal termination without prosecution, it may not appear unless reported to industry databases. For more on how embezzlement convictions affect employees long term, see our post on whether embezzlement shows up on a background check.
References
- Association of Certified Fraud Examiners (ACFE). (2024). Occupational Fraud 2024: A Report to the Nations. https://legacy.acfe.com/report to the nations/2024/
- Association of Certified Fraud Examiners (ACFE). (2025). In House Fraud Investigation Teams: 2025 Benchmarking Report. https://www.acfe.com/about the acfe/newsroom for media/press releases/press release detail?s=2025 acfe in house fraud investigation teams benchmarking report
- Federal Bureau of Investigation (FBI). Financial Crimes White Collar Crime. https://www.fbi.gov/investigate/white collar crime
- U.S. Department of Justice (DOJ). Corporate Fraud. https://www.justice.gov/criminal/criminal fraud
- Windham Brannon. (2024). An Employee Is Stealing from Your Company Now What? https://windhambrannon.com/blog/an employee is stealing from your company now what/
- Weisblatt Law Firm. (2025). Legal Steps to Take After Discovering Employee Embezzlement. https://weisblattlaw.com/blog/employee embezzlement legal steps houston/
- Forensic Strategic Solutions. (2021). Investigating Employee Embezzlement: Understanding Organizational Risks and Responses. https://forensicstrategic.com/fighting embezzlement fraud requires strategic moves and the right investigative team/
- Embroker. (2025). 70+ Employee Theft Statistics for 2025. https://www.embroker.com/blog/employee theft statistics/
- American Institute of Certified Public Accountants (AICPA). Forensic and Valuation Services. https://www.aicpa cima.com/topic/forensic valuation
- Axley Brynelson, LLP. (2025). After Discovering Embezzlement, Have a Strategy for Obtaining Restitution. https://www.axley.com/publication_article/embezzlement restitution/
Disclaimer
This article is intended for general informational and educational purposes only. It does not constitute legal, financial, accounting, or professional advice, and no attorney client or other professional relationship is created by reading or relying on this content. Every employee embezzlement situation is unique readers should consult qualified legal, investigative, and financial professionals before taking any action. For questions about FraudOrder services, visit https://fraudorder.co/